Info

Disclosure

Jan 13, 2004

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

Symantec LiveUpdate contains a flaw that allows a local user to obtain SYSTEM privileges. The issue occurs when an interactive LiveUpdate session is available and allows a non-privileged user to manipulate the GUI functionality to gain elevated privilege.

Classification

Location: Local Access Required
Attack Type: Attack Type Unknown
Impact: Loss of Integrity
Exploit: Exploit Public
Disclosure: OSVDB Verified

Solution

Upgrade to version 2.0 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Symantec Corporation	Windows LiveUpdate	1.70.x
		1.90.x

References

Secunia Advisory ID: 10609
CVE ID: 2003-0994 (see also: NVD)
Bugtraq ID: 9401
Keyword: AntiVirus Internet Security Norton SystemWorks
Mail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2004-01/0367.html
Vendor Specific Advisory URL: http://www.sarc.com/avcenter/security/Content/2004.01.12.html
Other Advisory URL: http://www.secnetops.biz/research/advisories/SRT2004-01-09-1022.txt
Vendor Specific Solution URL: http://www.symantec.com/techsupp/files/lu/lu.html

Credit

KF - dotslashsnosoft.com - Secure Network Operations

Direct URL: http://osvdb.org/3428

Info

Disclosure

Discovery

Dates

Exploit

Solution

Description

Classification

Solution

Products

Symantec Corporation

Windows LiveUpdate

References

Credit